Back to Checks
azure

Tenant authorization policy restricts guest invitations to users with specific admin roles or disables guest invitations

entra_policy_guest_invite_only_for_admin_roles
Service: entraSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra authorization policy controls who can send B2B guest invitations.

Secure posture is when invitations are restricted to specific admin roles (adminsAndGuestInviters) or completely disabled (none).

Prowler logoProwlerprowler-provider-azure

Risk

Open guest invitation rights let members or guests add external users without oversight, expanding the attack surface.

Impacts:

  • Confidentiality: data leakage via overshared resources
  • Integrity: privilege escalation through group/team access
  • Availability: difficult containment due to account sprawl

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_policy_guest_invite_only_for_admin_roles

Recommendation

Restrict invitations to Only users assigned to specific admin roles can invite guest users, or disable them where not needed. Apply least privilege (use dedicated Guest Inviter role), enforce approvals, allowlist trusted domains, and run periodic access reviews with audit monitoring to remove stale or risky guests.

Remediation

CLI

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/authorizationPolicy/authorizationPolicy --headers 'Content-Type=application/json' --body '{"allowInvitesFrom":"adminsAndGuestInviters"}'

Terraform

resource "azuread_authorization_policy" "<example_resource_name>" {
  allow_invites_from = "adminsAndGuestInviters" # Restricts guest invitations to specific admin roles, making the check PASS
}

Other

1Sign in to the Microsoft Entra admin center
2Go to Entra ID > External Identities > External collaboration settings
3Under Guest invite settings, select "Only users assigned to specific admin roles can invite guest users" (or select "No one in the organization can invite guest users")
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_policy_guest_invite_only_for_admin_roles(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for tenant_domain, auth_policy in entra_client.authorization_policy.items():
            report = Check_Report_Azure(metadata=self.metadata(), resource=auth_policy)
            report.subscription = f"Tenant: {tenant_domain}"
            report.resource_name = getattr(auth_policy, "name", "Authorization Policy")
            report.resource_id = auth_policy.id
            report.status = "FAIL"
            report.status_extended = "Guest invitations are not restricted to users with specific administrative roles only."

            if (
                getattr(auth_policy, "guest_invite_settings", "everyone")
                == "adminsAndGuestInviters"
                or getattr(auth_policy, "guest_invite_settings", "everyone") == "none"
            ):
                report.status = "PASS"
                report.status_extended = "Guest invitations are restricted to users with specific administrative roles only."

            findings.append(report)

        return findings

References